From nobody Sat Jul 25 06:37:01 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=openvz.org ARC-Seal: i=1; a=rsa-sha256; t=1784810336; cv=none; d=zohomail.com; s=zohoarc; b=n5lD8o/QacSNoznEW7WGAES+vQ33Pr9hJecMic8x635mkRfJRpsBla4VOoFYmUfpzayTrGmIX4R/MOX09dB+Es/LkbbSQsVQursKaUQf3Hy9WG+HMZKkaqVCJeXg2sRc2eibGhoZHCuLC0wHFYeSwW4Z+LV0mKKGO7gfpCrJ7W4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784810336; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=8EXT8nLB5sfw36l6ilVcT7uL0HuaGwTIPe2pmtwCIcw=; b=jBS+0t9H3ceQUnOxxUAeo8Rs0quPS9X1BmaOilewkaAK5iMcdGy8g9KS+M2Of0nW8UPDNchU6vjEntaUCmBLOc0I9HbshiJLLBWPgbspezvvhYzbzFqd7gRgf5rw8PjOYOj2XX0vgN4hLOUCp9oiifjTatewzZMfp97/WNqGv04= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784810336422804.1492540982532; Thu, 23 Jul 2026 05:38:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wmsh5-0008MA-Bn; Thu, 23 Jul 2026 08:38:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wmsgT-00089p-KB for qemu-devel@nongnu.org; Thu, 23 Jul 2026 08:37:55 -0400 Received: from mail-ej1-x631.google.com ([2a00:1450:4864:20::631]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wmsgQ-0008Tg-Vy for qemu-devel@nongnu.org; Thu, 23 Jul 2026 08:37:53 -0400 Received: by mail-ej1-x631.google.com with SMTP id a640c23a62f3a-c15f020a223so80500966b.1 for ; Thu, 23 Jul 2026 05:37:50 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:b8fe:da40:80d9:ac01]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1c32c90b58sm222619166b.39.2026.07.23.05.37.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 05:37:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1784810269; x=1785415069; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8EXT8nLB5sfw36l6ilVcT7uL0HuaGwTIPe2pmtwCIcw=; b=M2mihD09iZs9UAFk7sPdJvZ58bRZ6Yiexfdg3Tdr2PwLq4tejsSs9l9r6Uw7ClxZm2 iRow1TCAdpkJ0vy9ZrxvdAK8f3S5XxXkwLDwHH0b2sYf+qYTepHDS71zlesuN9hnXPlH jeuFKJm50XC5ENSurIbDExR4sSvKnyAGWw9iCFXnICxpiU2uwg9CrMdKGWEWt6Nnqymj 6pVznZw9Av383MEANKRq4bKNwUVPj87X09H5y98yJUIqiWFjSqZwsrOu167T8YlJg3R0 J94TleZp1KRrpPK7hzbXxci/A5F15FmwLTAxaTYuIVDcTcYw7zoSxLrlxzwccgMxj8eb dsAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784810269; x=1785415069; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=8EXT8nLB5sfw36l6ilVcT7uL0HuaGwTIPe2pmtwCIcw=; b=qrt6DULU/kqqQHJJl9HX2Uj0AGHJYq+/dHXeZvWQXjsuBC60znpiLKMT9oE4FyXe8D ONnhbOJJM/M9qJrS+WAmq8L3hS+ylss9ZsRtGlAcO30UhA+Y0f5tHK1dU2KFAMaFyIh/ XixKnVXeh05RYC1mVJWFpC22Ic6jkphdI1TiJzWXqFQje9vapccP3HK6LqDRtkWXmkL3 2PTxcodb5MYBprL94mewcKkmUxyt7hMo6kGb+QdJScootsOIms6A0K7QeQnFE08oPClw QjaDWnmLFc8VmA7wIhtiK7DdzO/RHLP2exVhly/1gEGfA443Eb2zkNLPxeNehq1AKR67 TZWA== X-Forwarded-Encrypted: i=1; AHgh+RoeMbQTHWso7Iq90s9UP9HB6EXy5zVxJ0coNg/1Ixzl1jsjZwMuC4B7qjs1rEO+k8kBdb4gr03JJueP@nongnu.org X-Gm-Message-State: AOJu0YxiwUkM8Qojrs6qjrBsEI2Ul1d/IutiEv/Y0FzWHft8Ss9wyrJ7 AbAFJakXp+/R5JxI8iqZkBruEeb+FyLyOzV0DKKD3tLuyW+/JAuqtkIjIxJqoII97HQ= X-Gm-Gg: AR+sD12urX3RCrVG2qX1vrdAWuWGms94uEMZmTCseMaNoucu9qppKIwb9955Xn9Fhaz vwPH7awMyh2WbCvryUgpVGKlgVqPe5WVIzFLorciNpEHoypwQgk2KBETlxYpi6OyEV3fqid0L3O EhT1x36o3Yw9WzdD2t6Mc9auepao1B/c/4QNDAGxTDu+NjwoAjvXGXuxvPmzL/BEO/R7+l0m6Lr E55KZ/SigVHzoq6p/uiPLkUPmflNKcFNwLdN/ZXV6jm9DjUCpfdYanPyB1AzO1/G9HfR8xRH3jq iZExvyqb8bbYqX19qocxEqsHRxICtWM66OZtANOcHYXpnKouVrUkSc+g69Dm77ewh0Rf+5Jl5OJ JT5MUJiT2iPJ3dRHkovCvwSXpmpcJAH9ROdbrmkdUr3GWrYRxdwGotHVS6mbU/2HYfIuo1SycK1 U= X-Received: by 2002:a17:907:1b1c:b0:c16:84dc:9607 with SMTP id a640c23a62f3a-c1c50b919a8mr121926966b.19.1784810269367; Thu, 23 Jul 2026 05:37:49 -0700 (PDT) From: "Denis V. Lunev" To: qemu-block@nongnu.org, qemu-devel@nongnu.org Cc: den@openvz.org, Kevin Wolf , Hanna Reitz , Vladimir Sementsov-Ogievskiy Subject: [PATCH 1/3] block/accounting: take stats->lock in latency histogram setters Date: Thu, 23 Jul 2026 14:37:43 +0200 Message-ID: <20260723123745.3294227-2-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723123745.3294227-1-den@openvz.org> References: <20260723123745.3294227-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::631; envelope-from=den@openvz.org; helo=mail-ej1-x631.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @openvz.org) X-ZM-MESSAGEID: 1784810337047158500 Content-Type: text/plain; charset="utf-8" block_latency_histogram_set() and block_latency_histograms_clear() replace BlockLatencyHistogram's nbins/boundaries/bins without taking stats->lock, while block_account_one_io() reads those same fields under that lock from whatever iothread completes the I/O. The result is usual use-after-free and qemu crash. Take stats->lock in both setters, matching the lock already held by the reader. Signed-off-by: Denis V. Lunev CC: Kevin Wolf CC: Hanna Reitz CC: Vladimir Sementsov-Ogievskiy --- block/accounting.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/block/accounting.c b/block/accounting.c index f00fe99740..c277b796eb 100644 --- a/block/accounting.c +++ b/block/accounting.c @@ -194,17 +194,19 @@ int block_latency_histogram_set(BlockAcctStats *stats= , enum BlockAcctType type, return -EINVAL; } =20 - hist->nbins =3D new_nbins; - g_free(hist->boundaries); - hist->boundaries =3D g_new(uint64_t, hist->nbins - 1); - for (entry =3D boundaries, ptr =3D hist->boundaries; entry; - entry =3D entry->next, ptr++) - { - *ptr =3D entry->value; - } + WITH_QEMU_LOCK_GUARD(&stats->lock) { + hist->nbins =3D new_nbins; + g_free(hist->boundaries); + hist->boundaries =3D g_new(uint64_t, hist->nbins - 1); + for (entry =3D boundaries, ptr =3D hist->boundaries; entry; + entry =3D entry->next, ptr++) + { + *ptr =3D entry->value; + } =20 - g_free(hist->bins); - hist->bins =3D g_new0(uint64_t, hist->nbins); + g_free(hist->bins); + hist->bins =3D g_new0(uint64_t, hist->nbins); + } =20 return 0; } @@ -213,11 +215,13 @@ void block_latency_histograms_clear(BlockAcctStats *s= tats) { int i; =20 - for (i =3D 0; i < BLOCK_MAX_IOTYPE; i++) { - BlockLatencyHistogram *hist =3D &stats->latency_histogram[i]; - g_free(hist->bins); - g_free(hist->boundaries); - memset(hist, 0, sizeof(*hist)); + WITH_QEMU_LOCK_GUARD(&stats->lock) { + for (i =3D 0; i < BLOCK_MAX_IOTYPE; i++) { + BlockLatencyHistogram *hist =3D &stats->latency_histogram[i]; + g_free(hist->bins); + g_free(hist->boundaries); + memset(hist, 0, sizeof(*hist)); + } } } =20 --=20 2.53.0 From nobody Sat Jul 25 06:37:01 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=openvz.org ARC-Seal: i=1; a=rsa-sha256; t=1784810309; cv=none; d=zohomail.com; s=zohoarc; b=TVgwrm3gzPs/RDOi1UnBZ3XG1McN+gfsbqxgAbeUEoxarQk+b3F7m8gLy+GCOsRK/OIxoAEPlE23Y7vynPPiypQEMQaur7rm1RAsQ9OHc9DY0P2JHM0mRdrgDtquZkHRVHJRyqjn2h4Ohb+GxYcnpbLwzPAkq/OTqC7n0ag+Mt8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784810309; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=PKfV0SXokYEslLTXjXh9+wVue+6wOlJ2hIFXS73iA80=; b=CQu4qY1KOnfboCLU5tcpPOfyBRWdiIlDeItevxe/sDXw6HVN02mSDs5xzMfgYQGEA1+dOT07vZo6mbqv2Ca6Gf7FqxRgmlPK5xojJAe4BNPrMcsM8Fdg0JTPDLYVRb0A0GIHhq0XlhlTKUIGtUEkScfodXJzZ76iV8dz2PE2b3c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784810309103566.5676090188274; Thu, 23 Jul 2026 05:38:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wmsge-0008BI-Tc; Thu, 23 Jul 2026 08:38:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wmsgT-00089q-Vq for qemu-devel@nongnu.org; Thu, 23 Jul 2026 08:37:55 -0400 Received: from mail-ej1-x632.google.com ([2a00:1450:4864:20::632]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wmsgS-0008Tr-45 for qemu-devel@nongnu.org; Thu, 23 Jul 2026 08:37:53 -0400 Received: by mail-ej1-x632.google.com with SMTP id a640c23a62f3a-c1c50c1e29bso82615966b.3 for ; Thu, 23 Jul 2026 05:37:51 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:b8fe:da40:80d9:ac01]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1c32c90b58sm222619166b.39.2026.07.23.05.37.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 05:37:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1784810271; x=1785415071; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PKfV0SXokYEslLTXjXh9+wVue+6wOlJ2hIFXS73iA80=; b=eSAakjUe/wh74APlrFeMMrlvYE1O+gYXdcrOF7cMGGc1BkRBBFgBRW8LKRmFtuU8+B 0ajumbUUdaKc3cNb7wWwrMdpwQMJQGyMTEFqBUV9t/bmUyC4mAqrLiOAEqyJm3OcQOrm GQB8lUufVVzomx4RYpP0/J8TaeqommmHHE/mZwy47Fv+4PAfb178opjFn+1Ys6awvmB7 8t6j04HqUR7EOOLwMFK7yQaLYBeBWQqtRRMtjaLzrpxtU00dSiKKZRpu6+FzUfMmqWl1 7nPJzfMs0vYQsph5TPjBYyEBqC1kkPf4519VR32F8LVh7mZ0WWow+I7G7SNKWjoaKh4j ANMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784810271; x=1785415071; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=PKfV0SXokYEslLTXjXh9+wVue+6wOlJ2hIFXS73iA80=; b=d3nB/SSzylic5HOKuSPTEFuoBW/HfWlYAmFYJvJfSOVyOtmDcjNMqQ7D1IFxhFPbRA gpX5BydDRnCXvWARilk701WZYbPF12yg4WGXzELw051Sz4RE/H5SehTSR+XRTW6k0vc+ ncI4Bv5F48/tjxGzK9hJWbFKIk6MWnaa/nh5HrhcLkhQaHDGB6Dr8htNeDvZ/Oik0kyG oRwyI4KrHvJiQdzTJkgwhPFMs/+nRiFaN+m2dlCGNVFVAYascUesp0VsuhfvraUFVbBn Lf6TFuD8G3oiIOwHCgKvDNyVLD2KVlOhpE3GZncNaRNYlJSfxQU/yJNyS83fguNbMXb5 iQlg== X-Forwarded-Encrypted: i=1; AHgh+RqzGaT6tCcYrZu8E/uU+46B9RlDB/XFC0V1ndFEeKFiiHfv969MEPr8KUvyYPThRbyVsHHhhtAVTBpE@nongnu.org X-Gm-Message-State: AOJu0YxTzIaSPIN+8lt2vQKG6R/CjrbOjolopb03Xx341YSpiPZn7tqW 5kRlDBPwc/og2s64ZFdCbPIn9piTMlx07gTEz04in+W3V6fhGV7uG/FHXcSz8roOqxU= X-Gm-Gg: AR+sD11kexQMPy74L8eYZMQAvuCrSnizciAhFKox/O1w7F/cV3kFZ1Z+icz1ak5rN71 LXPailaMA0fiEHYRb8dLxtKjPypuI1x65gEpfogPlSvYJ7JdUXHUTO0NqaPnfpsM+Zeohnp1Ace ETg9fhorkLdFcZ5fWnrRpO11mmzc+FlOte4ggAf/a+2ke+LnBQTrP7YLI8/YkA0G/aSkl7FcnTR J4bbwj8REtydZL/M79e8HR79YdkPQ9XbEu2j7WzlNRjANFN3rPypwqmq6uG6OZqL+6Ey8ayTF5k 8mQEKIBdrYGphoaVL70ZFb+9gzWL0Jl/MhOiLowezWkq3dO+eA6HaXrrQxp3wAvdJe9+6x+tW3l xDZdsztbH70OMpKwq3zUExiZKmxIcK7LLEs8LNyVLOARjGsfiTSDp3a8xqbPnM9EfcgKy8nO4Dp c= X-Received: by 2002:a17:907:25c3:b0:bed:9a7:5ed1 with SMTP id a640c23a62f3a-c1c506e8a62mr129875666b.5.1784810270703; Thu, 23 Jul 2026 05:37:50 -0700 (PDT) From: "Denis V. Lunev" To: qemu-block@nongnu.org, qemu-devel@nongnu.org Cc: den@openvz.org, Kevin Wolf , Hanna Reitz , Vladimir Sementsov-Ogievskiy Subject: [PATCH 2/3] block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats Date: Thu, 23 Jul 2026 14:37:44 +0200 Message-ID: <20260723123745.3294227-3-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723123745.3294227-1-den@openvz.org> References: <20260723123745.3294227-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::632; envelope-from=den@openvz.org; helo=mail-ej1-x632.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @openvz.org) X-ZM-MESSAGEID: 1784810311011158500 Content-Type: text/plain; charset="utf-8" bdrv_query_blk_stats() reads nr_bytes[], nr_ops[], failed_ops[], invalid_ops[], merged[], total_time_ns[], last_access_time_ns, and the latency histogram bins directly off BlockAcctStats, without taking stats->lock. block_account_one_io() updates the same fields under that lock from whatever iothread completes the I/O, so this is an unsynchronized read of concurrently-updated state. This is a narrower issue than the one fixed for the histogram setters. query-blockstats and block-latency-histogram-set are both plain (non-allow-oob) QMP commands, so they always run serialized on the monitor thread and can never execute concurrently with each other. Take stats->lock around the read for consistency. Signed-off-by: Denis V. Lunev CC: Kevin Wolf CC: Hanna Reitz CC: Vladimir Sementsov-Ogievskiy --- block/qapi.c | 102 ++++++++++++++++++++++++++++++--------------------- 1 file changed, 60 insertions(+), 42 deletions(-) diff --git a/block/qapi.c b/block/qapi.c index eabfbfc258..c3f20832b7 100644 --- a/block/qapi.c +++ b/block/qapi.c @@ -535,49 +535,67 @@ static void bdrv_query_blk_stats(BlockDeviceStats *ds= , BlockBackend *blk) BlockAcctTimedStats *ts =3D NULL; BlockLatencyHistogram *hgram; =20 - ds->rd_bytes =3D stats->nr_bytes[BLOCK_ACCT_READ]; - ds->wr_bytes =3D stats->nr_bytes[BLOCK_ACCT_WRITE]; - ds->zone_append_bytes =3D stats->nr_bytes[BLOCK_ACCT_ZONE_APPEND]; - ds->unmap_bytes =3D stats->nr_bytes[BLOCK_ACCT_UNMAP]; - ds->rd_operations =3D stats->nr_ops[BLOCK_ACCT_READ]; - ds->wr_operations =3D stats->nr_ops[BLOCK_ACCT_WRITE]; - ds->zone_append_operations =3D stats->nr_ops[BLOCK_ACCT_ZONE_APPEND]; - ds->unmap_operations =3D stats->nr_ops[BLOCK_ACCT_UNMAP]; - - ds->failed_rd_operations =3D stats->failed_ops[BLOCK_ACCT_READ]; - ds->failed_wr_operations =3D stats->failed_ops[BLOCK_ACCT_WRITE]; - ds->failed_zone_append_operations =3D - stats->failed_ops[BLOCK_ACCT_ZONE_APPEND]; - ds->failed_flush_operations =3D stats->failed_ops[BLOCK_ACCT_FLUSH]; - ds->failed_unmap_operations =3D stats->failed_ops[BLOCK_ACCT_UNMAP]; - - ds->invalid_rd_operations =3D stats->invalid_ops[BLOCK_ACCT_READ]; - ds->invalid_wr_operations =3D stats->invalid_ops[BLOCK_ACCT_WRITE]; - ds->invalid_zone_append_operations =3D - stats->invalid_ops[BLOCK_ACCT_ZONE_APPEND]; - ds->invalid_flush_operations =3D - stats->invalid_ops[BLOCK_ACCT_FLUSH]; - ds->invalid_unmap_operations =3D stats->invalid_ops[BLOCK_ACCT_UNMAP]; - - ds->rd_merged =3D stats->merged[BLOCK_ACCT_READ]; - ds->wr_merged =3D stats->merged[BLOCK_ACCT_WRITE]; - ds->zone_append_merged =3D stats->merged[BLOCK_ACCT_ZONE_APPEND]; - ds->unmap_merged =3D stats->merged[BLOCK_ACCT_UNMAP]; - ds->flush_operations =3D stats->nr_ops[BLOCK_ACCT_FLUSH]; - ds->wr_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_WRITE]; - ds->zone_append_total_time_ns =3D - stats->total_time_ns[BLOCK_ACCT_ZONE_APPEND]; - ds->rd_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_READ]; - ds->flush_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_FLUSH]; - ds->unmap_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_UNMAP]; - - ds->has_idle_time_ns =3D stats->last_access_time_ns > 0; - if (ds->has_idle_time_ns) { - ds->idle_time_ns =3D block_acct_idle_time_ns(stats); - } + /* + * nr_bytes[] etc. are mutated under stats->lock by block_account_one_= io() + * from an iothread, and latency_histogram[].{nbins,boundaries,bins} c= an + * be freed and reallocated by a concurrent block_latency_histogram_se= t() + * on the monitor thread, so every read here needs the same lock. + */ + WITH_QEMU_LOCK_GUARD(&stats->lock) { + ds->rd_bytes =3D stats->nr_bytes[BLOCK_ACCT_READ]; + ds->wr_bytes =3D stats->nr_bytes[BLOCK_ACCT_WRITE]; + ds->zone_append_bytes =3D stats->nr_bytes[BLOCK_ACCT_ZONE_APPEND]; + ds->unmap_bytes =3D stats->nr_bytes[BLOCK_ACCT_UNMAP]; + ds->rd_operations =3D stats->nr_ops[BLOCK_ACCT_READ]; + ds->wr_operations =3D stats->nr_ops[BLOCK_ACCT_WRITE]; + ds->zone_append_operations =3D stats->nr_ops[BLOCK_ACCT_ZONE_APPEN= D]; + ds->unmap_operations =3D stats->nr_ops[BLOCK_ACCT_UNMAP]; + + ds->failed_rd_operations =3D stats->failed_ops[BLOCK_ACCT_READ]; + ds->failed_wr_operations =3D stats->failed_ops[BLOCK_ACCT_WRITE]; + ds->failed_zone_append_operations =3D + stats->failed_ops[BLOCK_ACCT_ZONE_APPEND]; + ds->failed_flush_operations =3D stats->failed_ops[BLOCK_ACCT_FLUSH= ]; + ds->failed_unmap_operations =3D stats->failed_ops[BLOCK_ACCT_UNMAP= ]; + + ds->invalid_rd_operations =3D stats->invalid_ops[BLOCK_ACCT_READ]; + ds->invalid_wr_operations =3D stats->invalid_ops[BLOCK_ACCT_WRITE]; + ds->invalid_zone_append_operations =3D + stats->invalid_ops[BLOCK_ACCT_ZONE_APPEND]; + ds->invalid_flush_operations =3D + stats->invalid_ops[BLOCK_ACCT_FLUSH]; + ds->invalid_unmap_operations =3D stats->invalid_ops[BLOCK_ACCT_UNM= AP]; + + ds->rd_merged =3D stats->merged[BLOCK_ACCT_READ]; + ds->wr_merged =3D stats->merged[BLOCK_ACCT_WRITE]; + ds->zone_append_merged =3D stats->merged[BLOCK_ACCT_ZONE_APPEND]; + ds->unmap_merged =3D stats->merged[BLOCK_ACCT_UNMAP]; + ds->flush_operations =3D stats->nr_ops[BLOCK_ACCT_FLUSH]; + ds->wr_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_WRITE]; + ds->zone_append_total_time_ns =3D + stats->total_time_ns[BLOCK_ACCT_ZONE_APPEND]; + ds->rd_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_READ]; + ds->flush_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_FLUSH]; + ds->unmap_total_time_ns =3D stats->total_time_ns[BLOCK_ACCT_UNMAP]; + + ds->has_idle_time_ns =3D stats->last_access_time_ns > 0; + if (ds->has_idle_time_ns) { + ds->idle_time_ns =3D block_acct_idle_time_ns(stats); + } =20 - ds->account_invalid =3D stats->account_invalid; - ds->account_failed =3D stats->account_failed; + ds->account_invalid =3D stats->account_invalid; + ds->account_failed =3D stats->account_failed; + + hgram =3D stats->latency_histogram; + ds->rd_latency_histogram + =3D bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_READ]); + ds->wr_latency_histogram + =3D bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_WRITE]); + ds->zone_append_latency_histogram + =3D bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_ZONE_APPEND= ]); + ds->flush_latency_histogram + =3D bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_FLUSH]); + } =20 while ((ts =3D block_acct_interval_next(stats, ts))) { BlockDeviceTimedStats *dev_stats =3D g_malloc0(sizeof(*dev_stats)); --=20 2.53.0 From nobody Sat Jul 25 06:37:01 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=openvz.org ARC-Seal: i=1; a=rsa-sha256; t=1784810334; cv=none; d=zohomail.com; s=zohoarc; b=BJhAfY4lyi1bzo9oi8DbUSvpXOJv6v0AhLaABjmWGBV7X20m4zzAoBWgEgiYZSYpOb6da8nuEiKIzyPq7DAA4sXuRNA4ZCcBgF/F6BHAqwv9x8o1Tv0tyeLw7xj4imwwViApwap0HmmbsRJJ10RFYV1Vd1aVtoglQSD2vLVKaKk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784810334; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=lT3tAlUEOnvLakbkG7MR8bQ/jFeMpZ3j8U3lSAg3aFk=; b=k0nW5sEw/MBuToJmD6ZUQf7XMi+JclNZbwwZYX4fz95RmzBWyWdZ/U9NpINpOYmulxCGp1yPCza8KFycx86JnSj0pJ3qvxg5cYGfW5u2QAaN8o0w2C5O7haMj+8vq0sEYQv9y3UOXWitEmH1Zaa5CXO3DD2GsqRq02GdNgZoCpM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784810334558601.2348016985669; Thu, 23 Jul 2026 05:38:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wmsh5-0008Kz-2y; Thu, 23 Jul 2026 08:38:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wmsgV-00089s-2G for qemu-devel@nongnu.org; Thu, 23 Jul 2026 08:37:55 -0400 Received: from mail-ej1-x635.google.com ([2a00:1450:4864:20::635]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wmsgT-0008UA-Bl for qemu-devel@nongnu.org; Thu, 23 Jul 2026 08:37:54 -0400 Received: by mail-ej1-x635.google.com with SMTP id a640c23a62f3a-c16794450aeso75851966b.2 for ; Thu, 23 Jul 2026 05:37:52 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:b8fe:da40:80d9:ac01]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1c32c90b58sm222619166b.39.2026.07.23.05.37.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 05:37:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1784810272; x=1785415072; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lT3tAlUEOnvLakbkG7MR8bQ/jFeMpZ3j8U3lSAg3aFk=; b=X6Cehg7FgDADXRedksRc2ZCdsT6b5PYR1TswqUjOJKE98xu1h1IJhMkCP/NpjP8JaI mhGkRMM/U5bUpzIx0TNPMK7FQy5d43CILpFGID9jitueXE0UX2KqRC+WXZwbngbKqBu9 3rNmUsVzcIsheXX8db1Zw4EVNS9JdZYF2VdMiQBy/5zy05ZW8q+9SE1gywbzzrHUqwtL ei0S6iqrNDx1qZnBchLnFJjPHibIuSJIphE1cSFWa2U63yiHZLzAB+kIh2he/FQfd4Ns 6Kg2fWijq7thLW0JwUVvd+B0MDqyK+9GbQEXcNa44mH0wovrbp6yqTeyvkvxEwnLU6yZ mepA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784810272; x=1785415072; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=lT3tAlUEOnvLakbkG7MR8bQ/jFeMpZ3j8U3lSAg3aFk=; b=r7r7dQu9S1ig4S5MiS8l1pQmUYhTPEK42C0Uu71+u3EROmnE/ceb5CfWdWFO7ZWlBz RiUKTeQ7U+kotSku5Nnyr9ecBroGvIA3J2nzZ2+IAHiBSRpk2Hg8dQOYcAFySyasC7yM f5uB1VFsGtc50uC6ive1qQ9Hj2I+vSVBhsH47YYAHQ/1cK/NlnzrlyhWGeaNeg+hojOf oGhgK4uYMCk4I3NKOV/C8JUjbiXAiBxGvbt19lKfdWKIdcRcaoDUAZcmirl2jyKbwWx0 0rIp96BuJc6AWQlfRdvHnpRShrNaW1sX0hrVEzc7ON1JHa9+D7zzOYW0d7/r5/jO3IVP uLHw== X-Forwarded-Encrypted: i=1; AHgh+RquN4ZO30ni74XYagxCMEc+J/4n/QE2TWGvhV8UIuLtkv+HfoC8Th0yotvPB0fPsOORAskXW4uS9/xC@nongnu.org X-Gm-Message-State: AOJu0YxOoK5loNvcfA91pDfljKMJ3k8uNUVQbtLRZ776JA3BMRS0FeIj h/TjYP+7/E7fvzGptmcsdhmkINS2Dv8LOapSFN6A0ex5VDTijCzVWpJl62d94EPDUFM= X-Gm-Gg: AR+sD12r5JsBToQBk13QTb4/ORAALyWRUyGnb1xy45JzLBN5LvEhJCfxemMWROScxBU 8qI6+LgYIgpBdMm52UsZHRd9WfYxX1dVVlgMzk3X4XQFU7cmVxNHugKW+BU4OFCS4RSyivFzEFn FwF8JcdiZg4EUuSkjaHBfcXMalpfI4LBQnrBH0+hfwsqojdXIFSVKiCeRv0bLdsJPffoq2alwZY xhjVITBpwRKQn2+6J7vNVt5Q2Tp3ZX2k+2IXfpceJFMER8DCGw9I2Zy7wKV/bWSPoeDgnZ3BPVs akNclniOI43eJKAjFnGxs3cbspvdT33DxxWtf02/7eN3p72ba+WdRNYvA1aw7ele4Mu2jHcN2w0 MT4pPrbXCZgZKbj9zDJOgjrd0s3rj+mLg41jUNPHUGXQv/l5g33CRixRrc5BnFbPyLvgg4u+EiR U= X-Received: by 2002:a17:907:e006:20b0:c12:b2db:873d with SMTP id a640c23a62f3a-c1c50b41459mr89495466b.5.1784810271790; Thu, 23 Jul 2026 05:37:51 -0700 (PDT) From: "Denis V. Lunev" To: qemu-block@nongnu.org, qemu-devel@nongnu.org Cc: den@openvz.org, Kevin Wolf , Hanna Reitz , Vladimir Sementsov-Ogievskiy Subject: [PATCH 3/3] tests/unit: add reproducer for BlockAcctStats histogram locking race Date: Thu, 23 Jul 2026 14:37:45 +0200 Message-ID: <20260723123745.3294227-4-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723123745.3294227-1-den@openvz.org> References: <20260723123745.3294227-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::635; envelope-from=den@openvz.org; helo=mail-ej1-x635.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @openvz.org) X-ZM-MESSAGEID: 1784810337095158501 Content-Type: text/plain; charset="utf-8" block_latency_histogram_set() and block_latency_histograms_clear() replace BlockLatencyHistogram's nbins/boundaries/bins without taking stats->lock, while block_account_one_io() reads those same fields under that lock from whatever iothread completes the I/O. Add a test that races two real threads against block_latency_histogram_set() and block_acct_start()/block_acct_done() on the same BlockAcctStats. Applied here it passes, since the previous two commits already take the lock; reverting them locally reproduces the abort this series fixes, in about a second. Signed-off-by: Denis V. Lunev CC: Kevin Wolf CC: Hanna Reitz CC: Vladimir Sementsov-Ogievskiy --- tests/unit/meson.build | 1 + tests/unit/test-block-accounting.c | 114 +++++++++++++++++++++++++++++ 2 files changed, 115 insertions(+) create mode 100644 tests/unit/test-block-accounting.c diff --git a/tests/unit/meson.build b/tests/unit/meson.build index 5ba6b1a230..dc3fb954c0 100644 --- a/tests/unit/meson.build +++ b/tests/unit/meson.build @@ -75,6 +75,7 @@ if have_block 'test-blockjob': [testblock], 'test-blockjob-txn': [testblock], 'test-block-backend': [testblock], + 'test-block-accounting': [testblock], 'test-block-iothread': [testblock], 'test-write-threshold': [testblock], 'test-crypto-hash': [crypto], diff --git a/tests/unit/test-block-accounting.c b/tests/unit/test-block-acc= ounting.c new file mode 100644 index 0000000000..e749b73749 --- /dev/null +++ b/tests/unit/test-block-accounting.c @@ -0,0 +1,114 @@ +/* + * SPDX-License-Identifier: GPL-2.0-or-later + * + * BlockAcctStats latency histogram locking regression test + * + * Copyright (c) 2026 Virtuozzo International GmbH. + * + * Regression test for missing stats->lock in + * block_latency_histogram_set()/block_latency_histograms_clear(), + * racing block_account_one_io() reading the same fields from an + * iothread. Aborts reliably before the fix, passes after it. + */ + +#include "qemu/osdep.h" +#include "block/block.h" +#include "block/accounting.h" +#include "system/block-backend.h" +#include "system/block-backend-io.h" +#include "qapi/error.h" +#include "qemu/main-loop.h" +#include "qemu/thread.h" + +#define RACE_DURATION_MS 2000 +#define NUM_READER_THREADS 8 + +static bool stop_workers; + +/* + * Different bin counts, so the writer's g_free()/g_new() churn can be + * caught mid-update. Values are small enough (nanoseconds) that plain + * back-to-back start/done calls exercise every bin without sleeping. + */ +static uint64List boundaries_a[] =3D { + { .next =3D &boundaries_a[1], .value =3D 1000 }, + { .next =3D &boundaries_a[2], .value =3D 5000 }, + { .next =3D NULL, .value =3D 50000 }, +}; + +static uint64List boundaries_b[] =3D { + { .next =3D &boundaries_b[1], .value =3D 800 }, + { .next =3D &boundaries_b[2], .value =3D 3000 }, + { .next =3D &boundaries_b[3], .value =3D 20000 }, + { .next =3D NULL, .value =3D 200000 }, +}; + +static void *writer_thread(void *opaque) +{ + BlockAcctStats *stats =3D opaque; + + while (!qatomic_read(&stop_workers)) { + block_latency_histogram_set(stats, BLOCK_ACCT_READ, boundaries_a); + block_latency_histogram_set(stats, BLOCK_ACCT_READ, boundaries_b); + } + + return NULL; +} + +static void *reader_thread(void *opaque) +{ + BlockAcctStats *stats =3D opaque; + + while (!qatomic_read(&stop_workers)) { + BlockAcctCookie cookie; + + block_acct_start(stats, &cookie, 4096, BLOCK_ACCT_READ); + block_acct_done(stats, &cookie); + } + + return NULL; +} + +static void test_latency_histogram_race(void) +{ + BlockBackend *blk =3D blk_new(qemu_get_aio_context(), + BLK_PERM_ALL, BLK_PERM_ALL); + BlockAcctStats *stats =3D blk_get_stats(blk); + QemuThread writer, readers[NUM_READER_THREADS]; + int i; + + /* Histogram has to be enabled (bins !=3D NULL) before racing it. */ + g_assert(block_latency_histogram_set(stats, BLOCK_ACCT_READ, + boundaries_a) =3D=3D 0); + + stop_workers =3D false; + qemu_thread_create(&writer, "hist-writer", writer_thread, stats, + QEMU_THREAD_JOINABLE); + for (i =3D 0; i < NUM_READER_THREADS; i++) { + qemu_thread_create(&readers[i], "hist-reader", reader_thread, stat= s, + QEMU_THREAD_JOINABLE); + } + + g_usleep(RACE_DURATION_MS * 1000); + qatomic_set(&stop_workers, true); + + qemu_thread_join(&writer); + for (i =3D 0; i < NUM_READER_THREADS; i++) { + qemu_thread_join(&readers[i]); + } + + blk_unref(blk); +} + +int main(int argc, char **argv) +{ + bdrv_init(); + qemu_init_main_loop(&error_abort); + + g_test_init(&argc, &argv, NULL); + + g_test_add_func("/block-accounting/latency_histogram_race", + test_latency_histogram_race); + + return g_test_run(); +} --=20 2.53.0